Manage datasets

The Datasets listing page shows all of the datasets that you have access to in your Splunk implementation. You can see what types of datasets you have, who owns them, and how they are shared.

This topic covers the default capabilities of the Datasets listing page.

If the Splunk Datasets Add-on is installed, the Datasets listing page provides additional management features for table datasets. The Splunk Datasets Add-on installed by default in Splunk Cloud and Splunk Light.

For information about the table dataset features of the Datasets listing page, see Manage table datasets.

Open the Datasets listing page

In the Search app, click Datasets in the green Apps bar.

View dataset detail information

You can expand a dataset row to see details about that dataset, such as the fields contained in the dataset, or the date that the dataset was last modified. When you view the detail information of a table dataset, you can also see the datasets that that table dataset is extended from, if applicable.

In the Search & Reporting app, click Datasets to open the Datasets listing page.

Find a dataset that you want to review.

Click the > symbol in the first column to expand the row of the dataset details.

Explore a dataset

Use the Explorer view to inspect a dataset and determine whether it contains information you want. The Explorer view provides tools for the exploration and management of individual datasets.

Explore datasets with the View Results and Summarize Fields views.

Use a time range picker to see what datasets contain for specific time ranges.

Manage dataset search jobs.

Export dataset contents.

Save datasets as scheduled reports.

Perform the same dataset management actions that exist on the Datasets listing page.

Visualize a dataset with Pivot

Use Pivot to create a visualization based on your dataset. You can save the visualization as a report or as a dashboard panel. You do not need to know how to use the Splunk Search Processing Language (SPL) to use Pivot.

Investigate a dataset in Search

You can create a search string that uses the from command to reference the dataset, and optionally add SPL to the search string. You can save the search as a report, alert, or dashboard panel.

The saved report, alert, or dashboard panel is extended from the original dataset through a from command reference. An extended child dataset is distinct from, but dependent on, the parent dataset from which it is extended. If you change a parent dataset, that change propagates down to all child datasets that are extended from that parent dataset.

Manage dataset permissions

Change dataset permissions to widen or restrict their availability to other users. You can set up read and write access by role, and you can make datasets globally accesible, restricted to a particular app context, or private to a single user.

By default, only the Power and Admin roles can set permissions for datasets.

Lookup table files and lookup definitions are interdependent. Every CSV lookup definition includes a reference to a CSV lookup table file, and any CSV lookup table file can potentially be associated with multiple CSV lookup definitions. This means that each lookup table file must have permissions that are wider in scope or equal to the permissions of the lookup definitions that refer to it. For example, if your lookup table file is referenced by a lookup definition that is shared only to users of the Search app, that lookup table file must also be shared with users of the Search app, or it must be shared globally to all users. If the lookup table file is private, the lookup definition cannot connect to it, and the lookup will not work.

(Optional) Change the audience that you want the data model to Display for. It can display for users of a specific App or users of All apps.

(Optional) If the data model displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the data model.

Click Save or Cancel.

Share private lookup and data model datasets that you do not own

If you want to share a private dataset that you do not own, you can change its permissions though the appropriate management page in Settings. You cannot see private datasets that you do not own in the Datasets listing page.

Steps

Select the Settings page for the type of data model that you are looking for, such as Settings > Lookups > Lookup table files.

Locate the dataset that you want to share and select Edit > Edit Permissions.

Share the dataset at the App or All apps level, and set read/write permissions as necessary.

Click Save.

When you return to the Datasets listing page you see that the dataset is visible and has the new permissions that you set for it.

Delete datasets

You can delete lookups and table datasets through the Datasets listing page. You can delete a data model dataset from the Data Model editor.

Lookups and table datasets

In the Search & Reporting app, click Datasets to open the Datasets listing page.

Locate a lookup or table dataset that you want to delete.

Select Manage > Delete.

On the Delete Dataset dialog, click Delete again to verify that you want to delete the dataset.

Data model datasets

In the Search & Reporting app, click Datasets to open the Datasets listing page.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »